English
Menu

Information Security Basics

A web application has a vulnerability in which, if a logged-in user opens a trap page prepared by an attacker, the user's browser sends requests to the legitimate site that the user did not intend, such as transferring money or changing settings. Which is an appropriate countermeasure?

  1. AEmbed an unpredictable random value (token) per session in the forms for important operations, and verify that the value is correct when a request is received
  2. BIncrease the maximum number of characters for the password field
  3. CBack up the web server's logs every day
Show answer and explanation

Answer: A. Embed an unpredictable random value (token) per session in the forms for important operations, and verify that the value is correct when a request is received

This vulnerability is called cross-site request forgery (CSRF). When sending a request to the legitimate site, the browser automatically attaches that site's cookies (the logged-in session information), no matter which page the request was sent from. So if the server judges a request to be a genuine operation by the logged-in user based on cookies alone, it also accepts requests that a trap page caused the browser to send. The basic countermeasure is to embed an unpredictable random value per session (a CSRF token) only in the legitimate forms and verify it on the server. The trap page cannot learn this value, so it cannot construct a valid request. Other measures include using the SameSite attribute so cookies are not attached to requests sent from other sites, and requiring the password to be entered again before important operations such as transferring money. The difference from XSS is that XSS embeds a malicious script in the site, whereas CSRF makes the user's browser send legitimate-looking requests.

  • A. Correct. Verifying a token that the trap page cannot learn means only requests from legitimate forms are accepted.
  • B. The maximum length of an input field has nothing to do with being made to send unintended requests.
  • C. Backing up logs helps later investigation but does not prevent unintended requests.
Practice this topic Back to topic

Related calculators

Password Brute-Force Time CalculatorCompute the number of combinations and the entropy from the character set and length, and estimate brute-force time

Books on Information Security Basics Ad

As an Amazon Associate I earn from qualifying purchases.

More Information Security Basics questions

  1. A web application reads and displays a file by joining a file name given in a URL parameter to the name of its public folder. If a value containing ../ is given as the file name, configuration files and other files outside the public folder can be read. Which combination correctly gives the name of this attack and a countermeasure?
  2. If a web application keeps using the same session ID before and after login, an attacker may get the user to use a session ID the attacker prepared in advance and then, after the user logs in, impersonate the user with that ID. What is the most appropriate countermeasure against this attack?
  3. Which statement correctly describes a DDoS attack?
  4. Which statement correctly describes a zero-day attack?
  5. Which combination correctly describes CVE and CVSS, used in vulnerability management?